ES2726770T3 - Control of critical operations for security - Google Patents

Abstract

A system comprising: an operational section for carrying out a safety critical operation in response to a control order received through a transmission means from a control section (24) away from the operating section (18), having the control section (24) for controlling the execution of the critical operation for security, characterized in that the control order comprises a plurality of decryption keys or keywords (52) generated in a control order generation part of high integrity (28) of the control section (24), which are supplied only in response to a correct order from an operator, and the operating section (18) comprises a plurality of security switches by high integrity key (40 , 42) operating in a way that compares the respective keywords received from the command section, or generated by the operational section upon receipt of the keys of The encryption, through the transmission medium (36, 38), the execution of the critical operation for security being carried out only in the case of a correct comparison by means of the key security switches (40, 42) of their respective keywords.

Description

DESCRIPTION

Control of critical operations for security

This invention relates to systems configured to perform safety critical operations, and their control. “Critical safety operation” means an operation that would have or could foreseeably have irreversible physical consequences. An example without limitation is the release of a load (e.g., a pump, a missile or an auxiliary fuel tank) from an aircraft.

Although the invention is particularly relevant for a system in a vehicle (whereby any mobile platform, on the ground or underground, over water or underwater, in the air or in space) is also found to be applicable in stationary devices, for example, a ground missile launcher, a security gate or other access control device (the irreversible change in this case being the violation of implicit security that allows access), a processing plant, a power generation plant power or railway signaling.

U.S. Patent Application UU. US 2008/0121097 exposes a remote digital activation system.

In general, in known systems, only a critical operation for security is carried out if a verified order is received, and in the absence of a verified order, the critical operation for security is not carried out. Such systems do not require autocorrection of the control signals because the system is required to maintain its default "no operation" condition unless a verified order is received. This is in contrast to "availability based systems" where a "no operation" condition is not allowed. These systems routinely use a self-correction of data to ensure the continuation of an operation when required.

Conventionally, security-critical systems achieve high integrity or availability by doubling (and sometimes tripling or even quadrupling) hardware elements and the communication paths between those elements, and it is necessary for executive signals to be supplied via means different and agree with each other, or at least that most of these signals agree with each other.

The present invention provides a system comprising: an operational section for performing a safety critical operation in response to a control order received through a transmission means from a remote control section of the operating section, the control section for controlling the execution of the security-critical operation, where the control order comprises a plurality of decryption keys or keywords generated in a part of generating high integrity control orders of the command section, which they are supplied only in response to an operator correction order, and where the operational section comprises a plurality of high integrity key security switches whose function is to compare the respective keywords received from the command section, or generated by the operational section upon receipt of the decryption keys through by means of the transmission means, the execution of the critical operation for security being carried out only in the case of a correct comparison, by means of the security switches by key, of their respective keywords.

This invention is based on the recognition that, so far in regard to said signals, it does not matter by how many ways the signals are supplied. What is important is that the executive signal is received and verified correctly. In the present invention this can be done through a single transmission path.

Therefore, in a first aspect, the invention provides a system configured so as to control a critical operation for security by sending a plurality of decryption keys or keywords through a transmission medium. The transmission medium may comprise a transmission medium of low integrity.

In particular, the low integrity transmission medium may include an individual or common transmission path. In this way, the number of transmission channels in the system (usually 2, 3 or 4) can be reduced to one for most or all of its length. This can make possible a significant reduction in the complexity and cost of the system.

The system may comprise a plurality of switches, where each of them selectively responds to said keywords, requiring the operation of at least a majority of the switches to perform said control.

The switches can be arranged in series, for example, with respect to a power supply or other executive signal for the operation of said system.

There may be means to make the switches work in a predetermined sequence. For example, one of said keywords can be supplied to one of said switches through a logic gate to which an output is supplied from another of said switches.

A keyword can be sent to one of said switches via a serial data bus. The same data bus can be used for all keywords.

The system can be configured to provide local power to one of these switches as part of a data signal that contains the keyword.

When the control order comprises a plurality of decryption keys generated in a part of generating high integrity control orders of the command section, which are provided only in response to a correct order of an operator, the operational section may comprise a high integrity storage unit for storing a plurality of keywords generated only upon receipt of the decryption keys received from the control section through the transmission medium and the plurality of high integrity key security switches operate by comparing the generated keywords, performing the critical operation for security only in the case of a correct comparison using the key security switches.

This arrangement may be preferred if the bandwidth of the transmission medium is relatively low, since decryption keys require less bandwidth for transmission. However, the operational section must then have one more high integrity section to store the keywords and therefore additional hardware costs may be incurred.

Each switch can be configured to respond to one of these different keywords.

Likewise, the invention can be applied in particular to the control of safety critical operations in devices located remotely with respect to a control station, for example, in an unmanned aerial vehicle (UAV) or other vehicle. Therefore, the system can be a load management system.

Therefore, in another aspect, the invention provides an unmanned aerial vehicle comprising: an operating section as described above.

In a further aspect, it provides a controller for a device that operates remotely configured so as to execute a safety-critical operation and that includes a means to transmit an instruction or authorization to the device through a single transmission path. said operation comprising a plurality of keywords.

The invention will now be described simply by way of example with reference to the accompanying drawings, where; Figure 1 shows a critical system for conventional safety in an unmanned aerial combat vehicle "(UCAV)";

Figure 2 shows a safety critical system according to the invention in a UCAV;

Figure 3 shows part of the system of Figure 2;

Figures 4 and 5 show the implementation of two embodiments of the invention using the structure of Figure 3;

Figure 6 shows in more detail part of the structure of Figure 4; Y

Figure 7 shows a modification of the embodiment of Figure 5.

Referring to Figure 1, a conventional UCAV 10 comprises, as relevant herein, a radio receiver 12 and a mission computer 14, which operates an aerial section 16 of a load management system (SMS ). The SMS controls the operation and release of one or more charges (weapons) 18 mounted on an external support unit 20 of the UCAV. In the following description, the load is supposed to be a weapon that can be released, although it could similarly be some other device that can be released.

The UCAV is controlled by an operator at a ground station 24 that includes a transmitter 26, and in particular a ground-based controller section 28 of the SMS. The unordered release of any load by the UCAV would be a serious problem, and therefore SMS control is carried out through a security-critical system in which each of the secondary units 12, 14, 16 and 20 contain elements functional duplicates, and each is connected to the others by means of duplex communication channels 30, which include a double channel radio link 32 between the transmitter 12 and the receiver 26.

The communication channels are consolidated in an individual way only at the interface between the support 20 and the load. In general, SMS applications require various outputs (some critical for security) that must be activated in a logical sequence to achieve a weapon release.

A usual sequence of release of a charge is as follows:

• Weapon selection phase

^o The mission computer asks the SMS to select a weapon.

^o The air SMS selects the weapon and returns the selection to the mission computer.

^o The SMS switches the non-critical power supply for load safety (generally implemented by actuating an individual power relay or switch in the support unit).

^o The weapon carries out integrated tests.

• Gun assembly phase

^o The operator of the ground station sends a “gun assembly” order.

^o The SMS energizes the triggering tools (which follow the relevant interlock checks).

^o The SMS energizes the critical power supply for load safety (output of the security-critical SMS, implemented in general by means of two “serial” upper / lower power switches).

• Weapon release phase

^o The ground station operator authorizes the final release and sends a “weapon release” order.

^o The SMS energizes the release approval (safety-critical SMS output, implemented in general through two “serial” upper / lower power switches).

^o The SMS energizes the “Trip” output to the suspension and release equipment (safety critical SMS output, implemented in general by means of two “serial” upper / lower power switches).

Therefore, during the operation of the system of Figure 1, a critical order for security is duplicated and sent through both channels 30, 32 from the SMS controller 28. The order is executed if (and only yes) is properly receive both orders in a comparator 34 within the support 20. With this architecture, the entire system from the entrances of the ground operator to the outputs of the supports to the load 18 must be developed with the standards of hardware and software integrity plus elevated, p. eg, DEF-STAN-00-55 / 56 security integrity level 4 or equivalent, with all that implies in complexity and cost.

Figure 2 shows a system according to the invention that similarly opposes an unordered release of the load, but which is much simpler than the system of Figure 1. The parts already described have the same reference numbers than in figure 1.

In this embodiment, the land-based SMS section 28, the land station of the UCAV 26, the receiver of the UCAV 12, the mission computer 14 and the air section of the SMS 16 are configured and arranged so that they communicate with each other only through an individual low integrity communication channel 36, 38. The support unit has two key security switches (KSS) 40, 42, each of which changes to an active (closed) state when indicated by a respective unique keyword.

The outputs of the switches 40, 42 are compared in a comparator 34 as in Figure 1, and if they match the comparator sends a critical order for safety to the load 18.

The keywords are stored securely in a high integrity part of the land-based SMS section 28 and are generated only for transmission in response to procedural correction orders from the operator of the ground station. The storage, selection, recovery and release elements of the land-based SMS 28 are configured with safety-critical standards (high integrity or SIL4), although the rest of this together with the other system elements, with the exception of Switching modules 40, 42, it is only necessary that they have a lower integrity. The aerial part of the SMS 16 is shown as having independent communication paths 30 for each switch 40, 42, although it is possible to send the keywords to the switches via a common serial bus. This is especially convenient if there are more than two security switches per key in the support unit. For example, each weapon can have an arming switch and a release switch, and in fact there will probably be more than one support. Therefore, there can be a significant number of security switches per key in the SMS, each with its own unique password that is communicated through a common bus. Keywords for switches or operations that are not critical to security can be stored in air SMS 16 instead of in SMS land-based, thereby reducing the amount of data to be sent through the individual communications channel.

In this embodiment, the system integrity level requirements would be the following:

In an alternative embodiment, all the keywords of the security-critical SMS outputs are maintained in the air SMS 16, as well as the keywords of the non-critical security outputs. However, the key words of critical security exits are kept in encrypted form. Only the decryption keys are kept in the land-based SMS 28. During operation, the decryption keys of security critical operations, such as arming and release, are sent via the land-based SMS 28, and the keywords are decrypted in the air SMS 16. These then apply to switches 40, 42 as already described. Obviously, decryption keys are sent only when ordered by the operator of the ground station, and therefore until that moment the air SMS does not have all the necessary data to effect the release of the cargo. This embodiment requires that certain aspects of the air SMS (e.g., control and elimination of decryption keys) have a high level of integrity, although it has the advantage of less data transfer from the land-based SMS 28 In this embodiment, the required levels of integrity are;

In both embodiments, the reduction in the level of integrity of most of the SMS, together with the individual channel design of the system, can offer significant cost savings in the design, development and subsequent manufacturing of the system. However, the concept still allows for the elaboration of a reasoned security procedure (which includes the consideration of a “logical sequence” of events to effect a release), to support the eventual certification of the system.

Figure 3 illustrates that the function of comparator 34 can be achieved simply by connecting switches 40, 42 in series with respect to a quantity to be controlled. Here, that amount is a mains power supply 44, which when the switches 40, 42 are closed is supplied in 46 (e.g., to the mechanism load release) as an exit from the critical safety system. The common serial data bus 48 is also illustrated.

An implementation of the embodiment of Figure 3 is shown in Figure 4. The activation keywords 50 sent by the land-based SMS 28 are supplied to bus 48 and then to switches 40, 42, each of which is preprogrammed (read only) to respond to your respective keyword. Each switch also has a preprogrammed deactivation keyword, to be used if the weapon release is aborted.

Each switch 40, 42 has a processor for key comparison, which can be, for example, a specific microprocessor, a programmable logic device or a fixed masking device. The choice of device will depend on the particular application, especially the operating temperature range and the power supply requirements. The preprogramming of the activation and deactivation keywords can be implemented by mechanical switches (e.g., DIL), wired links, internal or external memory devices or within a data register or permanent microprocessor memory.

The data bus 48 (which can be a general purpose serial data bus, such as an RS422 or a USB) can be arranged to provide a local power supply to the switches as part of the data signal that It contains the keywords. Then, if no serial data is supplied to a particular switch, it will not be activated and will remain in a safe state.

As a further safety feature, signal isolation can be used at the data bus inputs to:

• Avoid an external failure mode of a serial data bus that results in accidental operation of the switch.

• Provide a high degree of immunity against electromagnetic noise.

• Maintain complete electrical isolation between control buses.

An advantage of the embodiment of Figure 4 is that the switches connected to the common data bus do not need to be individually addressable, because each one is operated by a single keyword. However, a disadvantage is that the switches are not interchangeable or replaceable without reprogramming the land-based SMS 28, because each has its own code. This disadvantage can be eliminated by performing Figure 5.

In this embodiment, each switch 40, 42, etc., is uniquely addressable. If a switch must be operated, the land-based SMS sends two (or more) respective long digital data strings 52 as keywords, along with the address of the switch. The addressed switch receives the keywords and compares them. If the comparison is valid, the switch is activated. The procedure is repeated below for the other switches, as required. Correct sequential operation of the switches can be included as one more safety interlock, for example, as shown in Figure 7, supplying the data signal to the second switch 42 and similarly to the subsequent switches (if any. ) through a respective AND 72 gate, to which the output of the previous switch 40 is also applied; This feature can also be included in the other embodiments.

It will be appreciated that in the embodiment of Figure 5, it is not necessary to program the drive keywords on the switches, but only their respective addresses. This can be achieved by an independent addressing model, or each switch can be programmed with one address. Encryption can be used, as in the embodiment of Figure 4, keeping the encrypted passwords of each switch in the air SMS.

Figure 6 shows one of the switches 40, 42 of Figure 4 in more detail. At 54 a combined power and data signal is received from bus 48. Preferably, the signal is a differential activation signal, where the encoded data uses a self-synchronized differential Manchester encoding. For the initialization of the switch, first the clock signal is provided only with inert data. In safety-critical applications, only the clock signal is enabled once the relevant safety interlocks (e.g., that the UAV is in flight and the trigger supply is activated) are confirmed as present.

The signal from the received data bus 54 is carried through an isolation transformer 56 to a data extraction and power supply unit 58, where the data component of the encoded data signal is extracted. The data signal is further rectified and regulated so as to provide a local power supply 60 to a switching element 62, to which the extracted data 64 is supplied from the data extraction unit 58. The switching element 62 compares the keyword in the data extracted with its previously programmed keyword, and if they match, the switching element instructs a power supply switch 66 (e.g., a power supply transistor or a solid state relay) that shut down and supply a DC power supply from network 68 to a power outlet switching power 70. A return information link 74 confirms to switching element 62 that the power supply switch has been closed.

The topology of a key security switch for use in the embodiment of Figure 5 is similar; The switching element in that case is configured so that it is addressable, and so that it receives and compares two or more keywords instead of comparing a received keyword with a previously programmed keyword in it.

Also, each key security switch can include intelligent features, e.g. eg, operation with a user-programmable activation period or a single shot.

For non-critical security switching tasks, a single key security switch can be used, instead of two or more in a cascade or voting arrangement.

Although a common data bus 48 is preferred for reasons of simplicity and cost, more than one bus can be used for greater integrity and availability, where each serves a single switch or a group of switches.

The invention also includes any combination of features set forth herein, whether or not they are specifically claimed.

Claims (16)

1. A system comprising: an operational section for performing a safety critical operation in response to a control order received through a transmission means from a control section (24) away from the operating section (18 ), having control section (24) to control the execution of the safety-critical operation, characterized by that The control order comprises a plurality of decryption keys or keywords (52) generated in a high integrity control order generation part (28) of the command section (24), which are provided only in response to a correct order of an operator, and the operative section (18) comprises a plurality of high integrity key security switches (40, 42) that operate so as to compare the respective keywords received from the command section, or generated by the operative section after the reception of the decryption keys, through the transmission medium (36, 38), the execution of the critical operation for security being carried out only in the case of a correct comparison by means of the key security switches ( 40, 42) of their respective keywords. 2. The system of claim 1, further comprising the transmission means (36, 38), wherein the transmission means comprises a common transmission path for decryption keys or keywords. 3. The system of claim 1 or claim 2, comprising a plurality of switches (40, 42), wherein each responds selectively to said received or generated keywords, requiring the operation of at least a majority of the switches to perform said control. 4. The system of claim 3, wherein the switches are arranged in series with respect to a power supply (44) or other executive signal for the operation of said system. 5. The system of claim 4, comprising means (72) for causing the switches to function in a predetermined sequence. The system of any one of claims 3, 4 or 5, wherein one of said keywords is sent to one of said switches through a serial data bus (48). 7. The system of any of the preceding claims, configured to provide local power to the switch (40, 42) from a data signal containing the keyword. 8. The system of claim 3 or any claim that depends on it, wherein each switch (40, 42) is configured to respond to one of said different keywords (52). 9. The system of claim 8, wherein each of said switches (40, 42) is individually addressable. 10. The system of any preceding claim, wherein the control order comprises a plurality of decryption keys, and the operating section comprises a high integrity storage unit for storing a plurality of keywords (52), generated only upon receipt. of the decryption keys received from the control section (24) through the transmission medium (36, 38), and the plurality of high integrity key security switches (40, 42) operate so that they compare the words key generated. 11. The system of claim 10, wherein the operative section (18) comprises means for decrypting the keywords and supplying them to the switches (40, 42). 12. The system of any preceding claim, which is configured to be incorporated, at least partially, in an unmanned aerial vehicle or another vehicle. 13. The system of claim 12, which is a load management system. 14. The system of any preceding claim, wherein the transmission medium (36, 38) comprises a transmission medium of low integrity. 15. The system of any preceding claim, wherein the control order comprises a plurality of decryption keys. 16. An unmanned aerial vehicle comprising the system of any preceding claim.